Optimole <= 4.2.19 - Unauthenticated PHP Object Injection via Attachment Rename
- ID
- WPSEC-2026-3081
- Plugin
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (optimole-wp)
- Affected
- from 4.0.0 before 4.2.20
- Remediation
- Update to 4.2.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Optimole on WPSec AttackSurface
- Fix released
- Published
Description
The Optimole plugin for WordPress is vulnerable to PHP Object Injection via the media rename and replace features in versions 4.0.0 up to, and including, 4.2.19, due to the database URL renamer passing every stored value that contains the attachment's URL and looks serialized to unserialize() without restricting the allowed classes. This makes it possible for unauthenticated attackers to plant a serialized PHP object in content they can write, such as a comment, which is instantiated when a user renames or replaces the referenced attachment. Exploitation requires a user to rename or replace that attachment. The plugin itself contains no known POP chain, so any real impact depends on one being present in another plugin or theme on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-3081/
- https://plugins.svn.wordpress.org/optimole-wp/tags/4.2.20/
- https://wordpress.org/plugins/optimole-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS